From 3a6251ca237a5f4bd6acb564f609bd009828e082 Mon Sep 17 00:00:00 2001 From: curo1305 Date: Thu, 4 Jun 2026 23:09:40 +0200 Subject: [PATCH] fix(06): CR-04 add allowlist validation for default_storage_backend Add _VALID_BACKENDS frozenset and validate body.backend before writing to DB in PATCH /api/users/me/default-storage. Returns HTTP 422 for any value not in the allowlist, preventing mass-assignment and logic bypass via arbitrary string values. Co-Authored-By: Claude Sonnet 4.6 --- backend/api/cloud.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/backend/api/cloud.py b/backend/api/cloud.py index dd9f32c..27c8194 100644 --- a/backend/api/cloud.py +++ b/backend/api/cloud.py @@ -940,6 +940,8 @@ async def list_cloud_folders( # ── PATCH /api/users/me/default-storage ────────────────────────────────────── +_VALID_BACKENDS = frozenset({"minio", "google_drive", "onedrive", "nextcloud", "webdav"}) + @users_router.patch("/me/default-storage") @account_limiter.limit("100/minute") @@ -951,9 +953,14 @@ async def update_default_storage( ) -> dict: """Update the current user's default storage backend. - The backend value is stored as-is (validated by the frontend dropdown). + The backend value is validated against the allowlist before storage. Returns the updated default_storage_backend value. """ + if body.backend not in _VALID_BACKENDS: + raise HTTPException( + status_code=status.HTTP_422_UNPROCESSABLE_ENTITY, + detail=f"Invalid backend. Valid values: {sorted(_VALID_BACKENDS)}", + ) request.state.current_user = current_user user = await session.get(User, current_user.id) if user is None: